Mozilla

mozilla

Mozilla Foundation Security Advisory 2010-59

SJOW creates scope chains ending in outer object

Announced
September 7, 2010
Reporter
Blake Kaplan
Impact
Critical
Products
Firefox, Thunderbird
Fixed in
  • Firefox 3.6.9
  • Thunderbird 3.1.3

Description

Mozilla developer Blake Kaplan reported that the wrapper class XPCSafeJSObjectWrapper (SJOW), a security wrapper that allows content-defined objects to be safely accessed by privileged code, creates scope chains ending in outer objects. Users of SJOWs which expect the scope chain to end on an inner object may be handed a chrome privileged object which could be leveraged to run arbitrary JavaScript with chrome privileges.

Michal Zalewski's recent contributions helped to identify this architectural weakness.

References